[ANNOUNCE] libX11 1.8.7
This release contains fixes for the issues reported in today's security
advisory: https://lists.x.org/archives/xorg-announce/2023-October/003424.html
along with:
* Fail XOpenDisplay() if server-provided default visual is invalid (!233)
* Bring XKB docs in line with actual implementation (!231, !228)
* Xutil.h: declare XEmptyRegion() and XEqualRegion() as Bool (!225)
* Assorted updates to en_US.UTF-8 compose keys (!213, !214, !215, !216,
!217, !219, !220, !222, !223, !226, !227, !229)
Alan Coopersmith (17):
Remove XkbSetBounceKeysDelay.man from list of man pages to build
docs: finish removing XkbGetBounceKeysDelay & XkbSetBounceKeysDelay
docs: remove XkbAllocDeviceLedInfo
docs: remove XkbGetAccessXTimeout & XkbSetAccessXTimeout
docs: remove XkbGetSlowKeysDelay & XkbSetSlowKeysDelay
docs: remove XkbGetStickyKeysOptions & XkbSetStickyKeysOptions
docs: XkbSAActionSetCtrls is really named XkbActionSetCtrls
docs: remove XkbChangeIndicators and Xkb{Get,Note}IndicatorChanges
docs: remove XkbGetNameChanges
docs: remove XkbKeySymsOffset
docs: fix names for XkbKeyKeyType & XkbKeyKeyTypeIndex
XOpenDisplay: ensure each screen has a valid root_visual pointer
CVE-2023-43785: out-of-bounds memory access in _XkbReadKeySyms()
CVE-2023-43786: stack exhaustion from infinite recursion in PutSubImage()
XPutImage: clip images to maximum height & width allowed by protocol
XCreatePixmap: trigger BadValue error for out-of-range dimensions
libX11 1.8.7
Antti Savolainen (2):
nls: add a compose sequence with double dead_tilde for ≈ (almost equal to)
Add two compose sequences for dagger/obelisk symbols
Benno Schulenberg (12):
nls: remove three duplicated combining acute accents
nls: order a few compose sequences left first, and in mirroring pairs
nls: remove four unobvious and redundant compose sequences for ¥ (yen)
nls: delete twenty eight compose sequences that cannot be typed
nls: use the shorter and more consistent name for the dead capital schwa
nls: harmonize the comments for compose sequences with combining accents
nls: add, correct, and normalize some comments of compose sequences
nls: delete twenty seven untypable Greek compose sequences
nls: change result of sequence ` ` from `¢` (CENT) to `₵` (CEDI)
nls: add compose sequences for `₲` (guaraní), `₭` (kip), and `₮` (tugrik)
nls: reshuffle the compose sequences for currencies into ascending order
nls: add two compose sequences for currency symbol `฿` (the Thai baht)
Christopher Chavez (1):
Xutil.h: use Bool for XEmptyRegion(), XEqualRegion()
G. Branden Robinson (1):
configure script reports stray, confusing "yes"
Walter Harms (1):
rm XkbSetBounceKeysDelay.man
Yair Mizrahi (1):
CVE-2023-43787: Integer overflow in XCreateImage() leading to a heap
overflow
jmcwilliams403 (1):
NLS: Drop two math sequences, slightly clean up APL sequences.
git tag: libX11-1.8.7
https://xorg.freedesktop.org/archive/individual/lib/libX11-1.8.7.tar.gz
SHA256: 793ebebf569f12c864b77401798d38814b51790fce206e01a431e5feb982e20b
libX11-1.8.7.tar.gz
SHA512:
67575740356aecc6a7a4898e92ff1007aa6a44ff506d80fe577c1bdc3d64a900edf545cf3e082e9f17c25f4afe28e724145d5e82ae428bdc44348d368d9451a6
libX11-1.8.7.tar.gz
PGP:
https://xorg.freedesktop.org/archive/individual/lib/libX11-1.8.7.tar.gz.sig
https://xorg.freedesktop.org/archive/individual/lib/libX11-1.8.7.tar.xz
SHA256: 05f267468e3c851ae2b5c830bcf74251a90f63f04dd7c709ca94dc155b7e99ee
libX11-1.8.7.tar.xz
SHA512:
d53bfc18f38d339a6a695b09835b2ae96b323881678bfe7ddca697605e3bdf4102ff49cc3078880a6c55b5977fcdd0aadaf5429086132de3a5bda302f79a2fa6
libX11-1.8.7.tar.xz
PGP:
https://xorg.freedesktop.org/archive/individual/lib/libX11-1.8.7.tar.xz.sig
--
-Alan Coopersmith- alan.coopersm...@oracle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
signature.asc
Description: PGP signature
X.Org Security Advisory: Issues in libX11 prior to 1.8.7 & libXpm prior to 3.5.17
X.Org Security Advisory: October 3, 2023 Issues in libX11 prior to 1.8.7 & libXpm prior to 3.5.17 Multiple issues have been found in the libX11 & libXpm libraries published by X.Org for which we are releasing security fixes in libX11 1.8.7 & libXpm 3.5.17. The first issue (CVE-2023-43785) can be triggered by connecting to an X server that sends specially crafted replies to X11 protocol requests. The other 4 issues can be triggered by opening specially crafted XPM format image files via libXpm. Two of the four issues have root causes in the libX11 library and are fixed there, but patches have also been applied to libXpm to avoid passing the invalid data to libX11 in the first place. 1) CVE-2023-43785 libX11: out-of-bounds memory access in _XkbReadKeySyms() Introduced in: X11R6.1 [released March 1996] Fixed in: libX11 1.8.7 Found by: Gregory James DUCK Fixed by: Alan Coopersmith of Oracle Solaris Engineering When libX11 is processing the reply from the X server to the XkbGetMap request, if it detected the number of symbols in the new map was less than the size of the buffer it had allocated, it always added room for 128 more symbols, instead of the actual size needed. While the _XkbReadBufferCopyKeySyms() helper function returned an error if asked to copy more keysyms into the buffer than there was space allocated for, the caller never checked for an error and assumed the full set of keysyms was copied into the buffer and could then try to read out of bounds when accessing the buffer. libX11 1.8.7 has been patched to both fix the size allocated and check for error returns from _XkbReadBufferCopyKeySyms(). Fix: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/6858d468d9ca55fb4c5fd70b223dbc78a3358a7f 2) CVE-2023-43786 libX11: stack exhaustion from infinite recursion in PutSubImage() Introduced in: X11R2 [released Feb. 1988] Fixed in: libX11 1.8.7 Found by: Yair Mizrahi of the JFrog Vulnerability Research team Fixed by: Alan Coopersmith of Oracle Solaris Engineering When splitting a single line of pixels into chunks that fit in a single request (not using the BIG-REQUESTS extension) to send to the X server, the code did not take into account the number of bits per pixel, so would just loop forever finding it needed to send more pixels than fit in the given request size and not breaking them down into a small enough chunk to fit. An XPM file was provided that triggered this bug when loaded via libXpm's XpmReadFileToPixmap() function, which in turn calls XPutImage() and hit this bug. Further hardening to prevent similar bugs was done in libX11 by making XPutImage() clip images to the maximum X protocol pixmap size (limited by the use of unsigned 16-bit integers for height & width) when writing to X pixmaps, and by making XCreatePixmap() generate X errors if a height or width was specified that did not fit into an unsigned 16-bit integer. In libXpm, hardening was done to return error codes for any call that would have passed out-of-bounds width or height values to XCreatePixmap(). Fix: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/204c3393c4c90a29ed6bef64e43849536e863a86 Hardening: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/73a37d5f2fcadd6540159b432a70d80f442ddf4a https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/b4031fc023816aca07fbd592ed97010b9b48784b https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/84fb14574c039f19ad7face87eb9acc31a50701c 3) CVE-2023-43787 libX11: integer overflow in XCreateImage() leading to a heap overflow Introduced in: X11R2 [released Feb. 1988] Fixed in: libX11 1.8.7 Found by: Yair Mizrahi of the JFrog Vulnerability Research team Fixed by: Yair Mizrahi of the JFrog Vulnerability Research team When creating an image, there was no validation that the multiplication of the caller-provided width by the visual's bits_per_pixel did not overflow and thus result in the allocation of a buffer too small to hold the data that would be copied into it. An XPM file was provided that triggered this bug when loaded via libXpm's XpmReadFileToPixmap() function, which in turn calls XCreateImage() and hit this bug. Further hardening to prevent similar bugs was done in libXpm to return error codes for any call to XCreateImage() that would have resulted in this calculation overflowing. Fix: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/7916869d16bdd115ac5be30a67c3749907aea6a0 Hardening: https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/91f887b41bf75648df725a4ed3be036da02e911e 4) CVE-2023-43788 libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() Introduced in: unknown - prior to xpm-3.4k [released 1998] Fixed in: libXpm 3.5.17 Found by: Alan Coopersmith of Oracle Solaris Engineering Fixed by: Alan Coopersmith of Oracle Solaris Engineering When the test case for CVE-2022-46285
[ANNOUNCE] libXpm 3.5.17
libXpm - X Pixmap (XPM) image file format library - This release contains fixes for the issues reported in today's security advisory: https://lists.x.org/archives/xorg-announce/2023-October/003424.html Alan Coopersmith (10): Set close-on-exec when opening files test: use g_pattern_spec_match_string if available Explicitly mark non-static symbols as export or hidden Fix CVE-2023-43788: Out of bounds read in XpmCreateXpmImageFromBuffer test: Add test case for CVE-2023-43789 (corrupt colormap info) Fix CVE-2023-43789: Out of bounds read on XPM with corrupted colormap test: Add test case for CVE-2023-43786 (stack exhaustion in PutImage) Avoid CVE-2023-43786: stack exhaustion in XPutImage() test: Add test case for CVE-2023-43787 (integer overflow in XCreateImage) libXpm 3.5.17 Yair Mizrahi (1): Avoid CVE-2023-43787 (integer overflow in XCreateImage) git tag: libXpm-3.5.17 https://xorg.freedesktop.org/archive/individual/lib/libXpm-3.5.17.tar.gz SHA256: 959466c7dfcfcaa8a65055bfc311f74d4c43d9257900f85ab042604d286df0c6 libXpm-3.5.17.tar.gz SHA512: 01d1b2dcbdd0c7927add19852ec1e68575d5957f043471b0aa6e2b3deb4df397e68a616e6d257ac5a38f60a836eacaae3dc0de5c4c312050673032edbc30f077 libXpm-3.5.17.tar.gz PGP: https://xorg.freedesktop.org/archive/individual/lib/libXpm-3.5.17.tar.gz.sig https://xorg.freedesktop.org/archive/individual/lib/libXpm-3.5.17.tar.xz SHA256: 64b31f81019e7d388c822b0b28af8d51c4622b83f1f0cb6fa3fc95e271226e43 libXpm-3.5.17.tar.xz SHA512: 52f9d2664a47a26c1a6ad65d18867de870b66947b0b0d99cca3512756a0aaa6ce2a245c0b49f20b70c3ce48bf04c47c333e8119a147465c277bca727f6ab017e libXpm-3.5.17.tar.xz PGP: https://xorg.freedesktop.org/archive/individual/lib/libXpm-3.5.17.tar.xz.sig -- -Alan Coopersmith- alan.coopersm...@oracle.com Oracle Solaris Engineering - https://blogs.oracle.com/solaris signature.asc Description: PGP signature
